PT-2024-35125 · Mintplex · Anything-Llm

Published 2024-06-20 · Updated 2025-10-15 · CVE-2024-5213

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions up to and including 1.5.3

Description An issue was discovered where the password hash of a user is returned in the response after login ("POST /api/request-token") and after account creations ("POST /api/admin/users/new"). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend.

Recommendations For versions up to and including 1.5.3, it is recommended to modify the response to exclude the User object's password hash, specifically the bcrypt hashed password, to prevent sensitive information exposure. As a temporary workaround, consider restricting access to the "POST /api/request-token" and "POST /api/admin/users/new" API endpoints until a patch is available. Avoid including the entire User object in the response to the frontend, and instead, only return necessary information.

Exploit

Fix

Weakness Enumeration

CWE-201

CWE-1230

Related Identifiers

CVE-2024-5213

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/8794fb65-50aa-40e3-b348-a29838dbf63d · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/9df4521113ddb9a3adb5d0e3941e7d494992629c · Patch
• https://osv.dev/vulnerability/CVE-2024-5213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5213 · Security Note
• https://t.me/cvenotify/83804 · Telegram Post
• https://t.me/cveNotify/138748 · Telegram Post